CVE-2021-37393

CVE-2021-37393 affects RPCMS v1.8 and earlier: the nickname variable is not sanitized before display, enabling stored XSS via the update password function. Users viewing articles by the injected user trigger the XSS. No remediation/fix details are provided in the connected documents.

CVE-2021-37392

Summary: CVE-2021-37392 affects RPCMS v1.8 and earlier. The nickname field is not properly sanitized before display, enabling stored XSS when API functionality is enabled and an attacker updates a user nickname with an XSS payload; victims viewing articles by the injected user may trigger the XSS...

CVE-2021-37392

In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. When the API functions are enabled, the attacker can use API to update user nickname with XSS payload and achieve stored XSS. Users who view the articles published by the injected user will...

PT-2021-21631

Name of the Vulnerable Software and Affected Versions RPCMS versions 1.8 and below Description The issue arises from the improper sanitization of the nickname variable before it is displayed on a page. When API functions are enabled, an attacker can exploit this by updating a user's nickname with...

CVE-2021-37393: Improper Neutralization of Input During Web Page Generation

In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. Attacker can use "update password" function to inject XSS payloads into nickname variable, and achieve stored XSS. Users who view the articles published by the injected user will trigger the...

RPCMS 跨站脚本漏洞

RPCMS is a software application. A website CMS system. A cross-site scripting vulnerability exists in RPCMS, which stems from the fact that the "Nickname" variable is not properly sanitized before it is displayed on a page in RPCMS v1.8 and below. The vulnerability can be exploited to inject an X...

CVE-2021-37392: Improper Neutralization of Input During Web Page Generation

In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. When the API functions are enabled, the attacker can use API to update user nickname with XSS payload and achieve stored XSS. Users who view the articles published by the injected user will...

PT-2021-21632

Name of the Vulnerable Software and Affected Versions RPCMS versions 1.8 and below Description The issue arises from the nickname variable not being properly sanitized before being displayed on a page. An attacker can exploit this by using the update password function to inject XSS payloads into...

RPCMS 跨站脚本漏洞

RPCMS is a software application, a web CMS system. RPCMS suffers from a cross-site scripting vulnerability that stems from a failure to properly clean up the nickname variable before it is displayed on a page in RPCMS v1.8 versions and below. With the API functionality turned on, an attacker can...

Cross site scripting

A Cross-site scripting XSS vulnerability exists in the comment section in ZrLog 2.1.3, which allows remote attackers to inject arbitrary web script and stolen administrator cookies via the nickname parameter and gain access to the admin panel...

CVE-2020-21316

A Cross-site scripting XSS vulnerability exists in the comment section in ZrLog 2.1.3, which allows remote attackers to inject arbitrary web script and stolen administrator cookies via the nickname parameter and gain access to the admin panel...

CVE-2020-21316

A Cross-site scripting XSS vulnerability exists in the comment section in ZrLog 2.1.3, which allows remote attackers to inject arbitrary web script and stolen administrator cookies via the nickname parameter and gain access to the admin panel...

PT-2021-10608

Name of the Vulnerable Software and Affected Versions: ZrLog version 2.1.3 Description: A Cross-site scripting XSS vulnerability exists in the comment section, which allows remote attackers to inject arbitrary web script and steal administrator cookies via the nickname parameter, gaining access t...

ZrLog 跨站脚本漏洞

ZrLog is a blogging system developed using the Java language. A security vulnerability exists in ZrLog 2.1.3, which can be exploited by remote attackers to inject arbitrary web scripts and stolen administrator cookies via the nickname parameter and gain access to the admin panel...

CVE-2020-21316: Improper Neutralization of Input During Web Page Generation

A Cross-site scripting XSS vulnerability exists in the comment section in ZrLog 2.1.3, which allows remote attackers to inject arbitrary web script and stolen administrator cookies via the nickname parameter and gain access to the admin panel...

CVE-2020-19617

Cross Site Scripting XSS vulnerability in mblog 3.5 via the nickname field to /settings/profile...

CVE-2020-19617

Cross Site Scripting XSS vulnerability in mblog 3.5 via the nickname field to /settings/profile...

Cross site scripting

Cross Site Scripting XSS vulnerability in mblog 3.5 via the nickname field to /settings/profile...

CVE-2020-19617

Cross Site Scripting XSS vulnerability in mblog 3.5 via the nickname field to /settings/profile...

PT-2021-10375

Name of the Vulnerable Software and Affected Versions: mblog version 3.5 Description: The issue is related to a Cross Site Scripting XSS vulnerability. It can be exploited via the nickname field to the "/settings/profile" API endpoint. Recommendations: For mblog version 3.5, update the software t...